user: add gitea-vault-admin site-admin bot and one-time Vault KV seeding

Why: the vault-plugin-secrets-gitea engine needs a purpose-built Gitea
site-admin credential to mint and delete per-user tokens. Provision that
account and its Vault seed here so the credential is generated once and never
exposed. Ben asked that the password be written to Vault exactly once and
never updated afterwards.

Change:
- Add config/git.unkin.net/user/gitea-vault-admin.yaml: a local site-admin bot
  (admin: true, limited visibility, no org/repo creation).
- Extend the user module with an optional vault_seed_path/vault_seed_mount: when
  set, write the account's generated password to Vault KV as admin_username and
  admin_password via vault_kv_secret_v2, with lifecycle ignore_changes on
  data_json so the write is create-only and never churns (random_password
  already never regenerates). This keeps the seed stable and prevents a re-apply
  from overwriting a password later rotated out-of-band by rotate-root.
- Add the hashicorp/vault provider (module plus root generate block); it reads
  VAULT_ADDR and VAULT_TOKEN already exported by the Makefile k8s login.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

environments/root.hcl

@@ -11,6 +11,11 @@ provider "woodpecker" {
   server = "https://ci.k8s.syd1.au.unkin.net"
 }
 
+# Address + token come from VAULT_ADDR / VAULT_TOKEN in the environment (the
+# Makefile authenticates via k8s auth before running terragrunt). Used to seed
+# bot-account credentials into Vault KV (see modules/user vault_seed_path).
+provider "vault" {}
+
 terraform {
   backend "consul" {
     address = "https://consul.service.consul"